Skip to content

feat: CVE conversion triager tool#4916

Merged
jess-lowe merged 22 commits into
google:masterfrom
jess-lowe:cve-conversion-triager-tool
Mar 5, 2026
Merged

feat: CVE conversion triager tool#4916
jess-lowe merged 22 commits into
google:masterfrom
jess-lowe:cve-conversion-triager-tool

Conversation

@jess-lowe

@jess-lowe jess-lowe commented Feb 26, 2026

Copy link
Copy Markdown
Contributor

Quite often do we need to compare multiple records of one CVE record to triage conversion issues, so this tool will allow us to compare three versions at a time.
image

You can select from the following record locations:

  • the og cve5 record
  • the og NVD record
  • the nvd-converted osv record in prod
  • the nvd-conversion metrics notes in prod
  • the nvd-converted osv record in test
  • the nvd-conversion metrics notes in test
  • the cve5-converted osv record in prod
  • the cve5-conversion metrics notes in prod
  • the cve5-converted osv record in test
  • the cve5-conversion metrics notes in test
  • the combined output in prod
  • the combined output in test
  • prod api
  • test api

It currently exists at /triage, and utilises a proxy mechanism to load the records, but not as a path (as to prevent accessing unrelated parts of the bucket)

In the future could add a tool for an LLM to help triage what the actual problem is, but that's for another day

google-labs-jules Bot and others added 10 commits February 24, 2026 02:55
This change introduces a new triage page to visualize and compare CVE
conversion data across different stages and environments.

- Added `gcp/website/triage_handlers.py` to handle triage requests and
  proxy GCS file access.
- Registered the new blueprint in `gcp/website/main.py`.
- Created the frontend template `gcp/website/frontend3/src/templates/triage.html`
  with a 3-column layout.
- Implemented frontend logic in `gcp/website/frontend3/src/triage.js` to
  fetch and display JSON data from GCS or the API.
- Added styles in `gcp/website/frontend3/src/triage.scss`.
- Updated Webpack configuration to include the new triage entry point.
- Verified with unit tests and frontend screenshots.

Co-authored-by: jess-lowe <86962800+jess-lowe@users.noreply.github.com>
This change introduces a new triage page to visualize and compare CVE
conversion data across different stages and environments.

- Added `gcp/website/triage_handlers.py` to handle triage requests and
  proxy GCS file access.
- Registered the new blueprint in `gcp/website/main.py`.
- Created the frontend template `gcp/website/frontend3/src/templates/triage.html`
  with a 3-column layout.
- Implemented frontend logic in `gcp/website/frontend3/src/triage.js` to
  fetch and display JSON data from GCS or the API.
- Added styles in `gcp/website/frontend3/src/triage.scss`.
- Updated Webpack configuration to include the new triage entry point.
- Verified with unit tests and frontend screenshots.

Co-authored-by: jess-lowe <86962800+jess-lowe@users.noreply.github.com>
This change introduces a new triage page to visualize and compare CVE
conversion data across different stages and environments.

- Added `gcp/website/triage_handlers.py` to handle triage requests and
  proxy GCS file access.
- Registered the new blueprint in `gcp/website/main.py`.
- Created the frontend template `gcp/website/frontend3/src/templates/triage.html`
  with a 3-column layout.
- Implemented frontend logic in `gcp/website/frontend3/src/triage.js` to
  fetch and display JSON data from GCS or the API.
- Added styles in `gcp/website/frontend3/src/triage.scss`.
- Updated Webpack configuration to include the new triage entry point.
- Verified with unit tests and frontend screenshots.

Co-authored-by: jess-lowe <86962800+jess-lowe@users.noreply.github.com>
This change introduces a new triage page to visualize and compare CVE
conversion data across different stages and environments.

- Added `gcp/website/triage_handlers.py` to handle triage requests and
  proxy GCS file access.
- Registered the new blueprint in `gcp/website/main.py`.
- Created the frontend template `gcp/website/frontend3/src/templates/triage.html`
  with a 3-column layout.
- Implemented frontend logic in `gcp/website/frontend3/src/triage.js` to
  fetch and display JSON data from GCS or the API.
- Added styles in `gcp/website/frontend3/src/triage.scss`.
- Updated Webpack configuration to include the new triage entry point.
- Verified with unit tests and frontend screenshots.

Co-authored-by: jess-lowe <86962800+jess-lowe@users.noreply.github.com>
…44985313989

feat: Add CVE conversion triage page
…44985313989

fix: improve patching issues with triage tool
@jess-lowe jess-lowe changed the title CVE conversion triager tool feat CVE conversion triager tool Feb 26, 2026
@jess-lowe jess-lowe changed the title feat CVE conversion triager tool feat: CVE conversion triager tool Feb 26, 2026
Comment thread gcp/website/triage_handlers.py
Comment thread gcp/website/frontend3/src/templates/triage.html Outdated
Comment thread gcp/website/frontend3/src/templates/triage.html Outdated
@jess-lowe

Copy link
Copy Markdown
Contributor Author

/gemini review

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a new CVE conversion triager tool, which is a great addition for comparing different CVE record versions. The implementation includes a new frontend page with its corresponding JavaScript and SCSS, and a backend proxy handler in Python. The overall structure is well-thought-out. I've included several suggestions to enhance code quality, maintainability, and adherence to best practices in both the frontend and backend code.

Comment thread gcp/website/frontend3/src/triage.js Outdated
Comment thread gcp/website/frontend3/src/triage.js Outdated
Comment thread gcp/website/frontend3/src/triage.js Outdated
Comment thread gcp/website/frontend3/src/triage.scss Outdated
Comment thread gcp/website/triage_handlers.py Outdated
Comment thread gcp/website/triage_handlers.py Outdated
jess-lowe and others added 8 commits February 26, 2026 11:11
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
another-rex
another-rex previously approved these changes Feb 27, 2026
Comment thread gcp/website/triage_handlers.py Outdated
Comment thread gcp/website/frontend3/src/triage.js Outdated
Comment thread gcp/website/frontend3/src/triage.js
Comment thread gcp/website/triage_handlers.py
Comment thread gcp/website/frontend3/src/triage.js Outdated
@jess-lowe jess-lowe requested a review from another-rex March 4, 2026 04:44
@jess-lowe jess-lowe merged commit 71eeaad into google:master Mar 5, 2026
20 checks passed
@jess-lowe jess-lowe deleted the cve-conversion-triager-tool branch March 5, 2026 23:43
tymzd pushed a commit to tymzd/osv.dev that referenced this pull request Apr 13, 2026
Quite often do we need to compare multiple records of one CVE record to
triage conversion issues, so this tool will allow us to compare three
versions at a time.
<img width="2557" height="1185" alt="image"
src="https://github.com/user-attachments/assets/beb213fd-a2a0-4fe0-895d-1454bccc722b"
/>

You can select from the following record locations:
- the og cve5 record
- the og NVD record
- the nvd-converted osv record in prod
- the nvd-conversion metrics notes in prod
- the nvd-converted osv record in test
- the nvd-conversion metrics notes in test
- the cve5-converted osv record in prod
- the cve5-conversion metrics notes in prod
- the cve5-converted osv record in test
- the cve5-conversion metrics notes in test
- the combined output in prod
- the combined output in test
- prod api
- test api

It currently exists at /triage, and utilises a proxy mechanism to load
the records, but not as a path (as to prevent accessing unrelated parts
of the bucket)


In the future could add a tool for an LLM to help triage what the actual
problem is, but that's for another day

---------

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants